Privacy Policy

Last updated: July 26, 2026

In short: Polymorph is a web-based, gamified language-learning platform, starting with Learn English. Adults (18+) subscribe for themselves; teens (13–17) can learn with a parent or guardian as the subscriber; and when our school programs launch, schools will be able to bring Polymorph to their students — including children under 13 — under a separate school agreement (Section 8). Right now, during our founding-member pre-launch (open to adults 18+ only), we collect your name, email, and phone number — plus basic device and usage data (Section 3) — so we can be personally in touch about next steps. We do not sell your personal information or share it for targeted advertising, we never direct advertising or marketing at minors (users under 18) or at school-program students, and we will not use your content or conversations to train or improve AI models without your opt-in consent (voice recordings are never used for AI training). This policy explains what we collect, why, who receives it, and the choices you have.

1. Our privacy commitments

• We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. This covers all users and all data we hold. We will never sell or share the personal information of minors (users under 18) or of school-program students. For adult users, any future proposal to sell or share data we have already collected would be a material change requiring your fresh opt-in consent under Section 15, with any legally required opt-outs applying to data collected after the change. We never direct any form of advertising or marketing at minors or at school-program students.
• We do not use your learning content, conversations, or user-generated content to train or improve AI models unless you separately opt in. The default is off (Section 5). Voice recordings are never used to train or improve AI models, whether or not you opt in (Section 6), and we never use school-program student data to train or improve AI models (Section 8).
• We do not share or sell your mobile number or SMS consent data to third parties or affiliates for their marketing, and SMS marketing is adults-only (Section 10).
• Material policy changes do not apply retroactively to data we already hold without your fresh opt-in consent — including any new AI-training use — except where a change is required by law or legal process (Section 15).
• Polymorph serves adults (18+), teens (13–17) with parent or guardian consent, and — when school programs launch — schools and their students. Children under 13 cannot sign up on their own; they will be able to use Polymorph only through a school program (Section 8).

2. Who we are and what this policy covers

Contact us about privacy at wing@ngchow.com or by post at the address above. This policy covers all visitors, founding members, subscribers, and authorized users (including teen learners). For school-program student data, the school is the controller and we process it on the school's behalf under a separate written school agreement; Section 8 describes that framework and the agreement's precedence. Billing, subscriptions, and acceptable use are governed by our Terms of Service at /terms.

3. What we collect, by feature

Live now — founding-member signup and contact forms: first name, last name, email address, phone number with country dial code, and your confirmation that you are 18 or older (an attestation — we do not collect your date of birth). Founding-member signup remains open to adults (18+) only. These forms are hosted by Framer's form infrastructure, which processes submissions on our behalf.

At launch — account and subscription: login details, chosen plan (Lifestyle, Serious, or Dedicated), and the devices signed in to your account. We track device count only to enforce each plan's simultaneous-device limit, and we record whether offline downloads are enabled for your plan. For teen learners (13–17), the parent or guardian is the subscriber and account holder, and the teen uses Polymorph as an authorized user; see Section 8 for the age screen and parent/guardian consent flow that will be in place before teens can register.

Learning activity (at launch): lessons completed, answers, common mistakes, and progress. Our AI tutor uses this to remember past interactions and recent learnings and personalize your instruction (see Section 5).

AI tutor conversations (at launch): the messages you exchange with the tutor.

Speaking practice (planned): voice recordings processed by automatic speech recognition to give pronunciation and speaking feedback. See Section 6 on what we do and do not do with audio.

User-generated content and social features (planned): content you author, your friends list, and presence status. Content and presence you choose to share are visible to the people you share them with.

School programs (planned): when school programs launch, the school will provide or direct the collection of student information (for example, roster and login details), and students will generate the learning-activity, conversation, and — where the school enables it — speaking-practice data above. We collect the minimum student data needed for the educational purpose the school authorizes, and we process it solely on the school's behalf and instructions (Section 8).

Payments (at launch): paid subscriptions are not yet live. When they launch, payments will be handled by a third-party payment processor, which we will name in this policy before any payment data is collected (Section 7). We will never see or store your full card number; we will receive only subscription status and transaction confirmations.

Automatically: device type, browser, IP address, and usage logs, plus strictly necessary cookies (Section 14).

Statutory categories (for US state-law purposes): identifiers (name, email, phone, IP address); commercial information (subscription and transaction records, at launch); internet activity (usage logs and, at launch, your learning activity and progress); audio (voice recordings, once speaking practice launches); inferences (tutor personalization, at launch); and education information (school-program student records, when school programs launch — this FERPA-linked category does not cover consumer learning progress, which falls under internet activity and inferences). Pre-launch, we collect only the identifier and internet-activity categories; the others begin when the relevant feature launches. Account login credentials (collected at launch) are sensitive personal information under California law; we use them only to authenticate you and secure your account, and we do not use or disclose sensitive personal information for purposes that would trigger a right to limit its use under California law (Section 16). When school programs launch, student data will be education records processed on the school's behalf; we will never sell it, share it, or use it for any form of advertising (Section 8). We do not collect precise geolocation, government-issued identifiers, or biometric identifiers (Section 6), and we use and disclose the information above only for the purposes stated in this policy.

4. How and why we use information

| Data | Purpose | Legal basis (EEA/UK) | Shared with | Kept | |---|---|---|---|---| | Signup/contact form details | Contact you about founding membership and next steps; service messages; SMS (Section 10) | Consent | Framer (form hosting) | Until onboarding completes (after which these details are retained as account data under the row below) or you ask us to delete them; at most 24 months from collection | | Account data | Provide the service; enforce device limits; support | Contract* | Our website hosting providers (currently Framer and Vercel) | Account life, then deleted or de-identified 30 days after closure (Section 11) | | Learning activity and tutor memory | Personalize instruction; show progress | Contract* | AI model providers (processors — Section 7) | Account life; deleted on request | | AI conversations and voice | Deliver tutoring and speech feedback | Contract* | AI model providers (processors — Section 7) | Voice: deleted after transcription and pronunciation analysis (Section 6). Transcripts/prompts: up to 24 months; deleted earlier on request | | Payment records | Billing, fraud prevention, tax and accounting | Contract; legal obligation | Our payment processor (Section 7) | As required by applicable law | | Server logs and device data | Security, debugging | Legitimate interests | Our website hosting providers (currently Framer and Vercel) | 12 months | | UGC and social data | Provide authoring and social features | Contract* | Users you choose to share with | Until you delete it; after account closure it remains exportable for 30 days, then is deleted (Section 11) | | School-program student data (when school programs launch) | Provide the service for the school's educational purposes, solely on its instructions | The school is the controller and determines the basis; we act as its processor (Section 8) | The school and the staff it authorizes; the processors above, under the same limits | For the school engagement; then deleted or returned to the school (Section 8) |

* Teen learners (EEA/UK): the subscription contract is with the parent or guardian, not the teen, so we do not rely on the contract basis for a teen learner's data. For teens we rely on consent given through our parent/guardian consent flow (including parental consent where the teen is below the applicable national age of digital consent under Article 8 GDPR) and, for security and service-integrity processing, on our legitimate interests. Withdrawing consent is covered in Sections 9 and 16.

We do not use your information for targeted advertising (Section 1), and we do not make automated decisions about you that have legal or similarly significant effects. Lesson sequencing and tutor personalization adapt what you see next; they do not gate credentials, enrollment, or access.

5. AI features and AI training

• You are talking to an AI. The Polymorph tutor is AI-generated, and we say so at the start of every tutoring interaction. AI tutoring content and feedback can be wrong; it is a learning aid, not a credentialed teacher.
• Tutor memory. The AI tutor remembers your past interactions, common mistakes, and recent learnings to personalize instruction. This memory is used only to teach you. You can have it deleted at any time by exercising your deletion rights (Section 9).
• No training without opt-in. We do not use your conversations, learning content, or user-generated content to train or improve AI models unless you separately opt in. The default is off. Voice recordings are never used to train or improve AI models, whether or not you opt in — they are deleted after processing (Section 6). This includes any future use of data we already hold — see Section 15.
• School programs. For school-program student data, AI features run under the school's settings and control, and we never use student data to train or improve AI models. Parental rights are respected through the school (Section 8).
• Vendors. AI features will be powered by third-party AI model providers acting as our processors, under contracts that prohibit them from using your data to train or improve their models. We will name them in Section 7 before AI features launch.
• Human review. Where our staff review AI conversations (for example, for safety or quality), access is limited and logged. You can ask a human to review any AI-generated assessment or feedback: contact wing@ngchow.com.

6. Voice recordings and biometrics

When speaking practice launches, your recordings will be used solely to transcribe your speech and analyze your pronunciation so we can give you feedback, then deleted once transcription and pronunciation analysis are complete. We never use your recordings to train or improve AI models, and we will not use your recordings to develop voice-cloning technology. Speaking practice will be available to adult and teen users when it launches; for school-program learners, it is available only where the school enables it (Section 8). We have assessed our planned speech processing under biometric-privacy laws (including Illinois BIPA, Texas CUBI, and Washington RCW 19.375): we do not create voiceprints or any biometric identifier, and we do not use audio to identify who is speaking. If we ever propose to create biometric identifiers, we will first give notice, obtain written consent, and publish a retention-and-destruction schedule.

7. Who we share information with

We share personal information only with:

• Service providers under contract, limited to the purposes above. Today that means Framer (form hosting) and our website hosting providers (currently Framer and Vercel). When the relevant features launch, this will also include our payment processor and AI model providers, each of which we will name in this policy before those features go live. This list, which we keep current in this policy, is the authoritative list of our service providers (and, for school-program student data, our subprocessors).
• Other users, when you use social features — only what you choose to share.
• The parent or guardian who holds a teen account — the account, subscription, and billing information for the subscription they hold. The teen's learning activity and AI tutor conversations are shared with the parent or guardian only as described in Section 9.
• Schools, for school-program student data — the school and the staff it authorizes control access to that data (Section 8).
• Authorities or others where legally required, or to protect users, the public, or our legal rights.
• A successor in a merger, acquisition, or asset sale. If that happens, your data remains subject to the promises in this policy; any new use requires the notice-and-consent process in Section 15.

We do not sell personal information or share it for targeted advertising — including children's, teens', and student data (Section 1) — so there is no "Do Not Sell or Share" step for you to take. We honor Global Privacy Control (GPC) signals as opt-outs of sale, sharing, and targeted advertising; because we do none of these, the signal currently has no additional effect. Any future sale or sharing of data we already hold would be a material change requiring your fresh opt-in consent under Section 15 (and would never extend to minors' or school-program students' data); any opt-outs required by law would apply to data collected after such a change.

8. Children, teens, and school programs

Who can use Polymorph. Adults (18+) subscribe for themselves. Teens (13–17) may use Polymorph with parent or guardian consent: the parent or guardian accepts the Terms, holds the subscription, and pays, and the teen uses the service as an authorized user. Children under 13 cannot create consumer accounts; they will be able to use Polymorph only through a school program.

Under-13s on the consumer product (COPPA). Because children under 13 cannot self-register, we do not knowingly collect personal information from children under 13 through the consumer product. If we learn we have, we delete it promptly — report it to wing@ngchow.com. Before teens can register, an age screen and our parent/guardian consent flow will be in place, and we will update this policy with how they work.

Privacy-by-default for minors. Minors get our most protective settings by default: no targeted advertising (nobody gets that), never any advertising or marketing directed at minors, no SMS marketing (adults-only — Section 10), no selling of personal information, and data minimization. Any opt-in choices on a teen account — including AI training (Section 5) — can be made only by the parent or guardian who holds the subscription.

School programs (planned). When school programs launch, schools and districts will bring Polymorph to their students — including students under 13 — under a separate written agreement. In that model:

• The school authorizes our collection and use of student personal information, strictly limited to educational purposes, consistent with FTC guidance under COPPA permitting schools to authorize the collection of student personal information solely for educational purposes.
• We act as a "school official" with a legitimate educational interest under FERPA, processing education records solely on the school's behalf and instructions.
• We never use student data for advertising or marketing of any kind, never sell it, and never send SMS messages to students.
• We collect the minimum student data needed for the authorized educational purpose — minimization is the default.
• The school controls access to, correction of, and deletion of student data. Parents, guardians, and eligible students (students 18 or older) exercise FERPA review and amendment rights through the school; deletion of student data is handled through the school under our school agreement and, for students under 13, consistent with COPPA's parental-deletion protections exercised through the school.
• When a school engagement ends, we delete the student data or return it to the school.
• AI features for school-program learners run under the school's settings and control; we never use student data to train or improve AI models (Section 5).

The separate school agreement and data-processing terms will be in place before school programs launch; where they conflict with this policy, the school agreement governs for that school's student data.

EEA / UK. The age at which a young person can consent to online services themselves varies by EEA country (between 13 and 16); we will meet the applicable age and consent requirements in each country before opening teen registration there. In the UK, the Age Appropriate Design Code applies to users under 18, and we follow its approach for all minors: high-privacy defaults, data minimization, no nudging toward weaker privacy settings, and no profiling for advertising (we do none for anyone).

9. Your rights and choices

Wherever you live, you can ask us to: access a copy of your data, correct it, delete it, or port it in a usable format. You will not be discriminated against for exercising rights. For a teen account, both the teen and the parent/guardian subscriber can exercise these rights, with one limit that protects the teen's own privacy and matches the parental-sharing scope in Section 7: a parent or guardian's access or portability request covers account, subscription, and billing data; the teen's learning activity and AI tutor conversations are included only with the teen's knowledge, or where necessary to protect the teen's safety. Consent given on a teen account (Section 8) can be withdrawn by the parent or guardian who gave it, and by the teen for their own data where local law gives the teen that right. For school-program student data, requests go through the school, which controls that data; we support the school in fulfilling them, and parents, guardians, and eligible students exercise review rights through the school (Section 8). Additional rights by jurisdiction are in the table in Section 16, including: opting out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do none of these — tutor personalization only adapts lesson content, Section 4); limiting use of sensitive personal information (which does not currently apply — see Section 3); appealing a denied request; and, in the EEA/UK, withdrawing consent (as easily as you gave it), objecting to processing, and complaining to your supervisory authority.

How to exercise them: email wing@ngchow.com. We verify requests by matching the details you provide against the account or signup record (typically your email, and a confirmation link sent to it); we may ask for one more piece of matching information if needed, and we use it only for verification. Authorized agents may submit requests with proof of authority. We respond within 45 days, extendable once by a further 45 days where the law allows; where your local law sets a shorter deadline, we meet it. If we deny a request we explain why and how to appeal. We do not offer financial incentives tied to your personal information; when subscriptions launch, any free trial will be available to everyone on the same terms.

10. Text messages (SMS)

We collect SMS consent separately from your phone number: the founding-member form includes a distinct, clearly labeled opt-in that discloses the texts you will receive, and providing your phone number alone does not opt you in to texts. SMS marketing consent is adults-only: we collect it only from people 18 or older, we do not send marketing texts to minors, and we never send SMS messages to school-program students (Section 8). Our texts are sent by the Polymorph team. We treat founding-member and launch-related texts that promote Polymorph as marketing messages requiring your prior express written consent. Message and data rates may apply. In this policy we commit that:

• Marketing texts are sent only with your prior express written consent, which is never a condition of purchase.
• You can revoke consent by any reasonable means (replying STOP, any other reply, email, support), and we honor revocation within 10 business days.
• Your mobile number and SMS opt-in/consent data are not shared with or sold to third parties or affiliates for their marketing. If we ever engage a vendor to deliver our texts, it will be bound by confidentiality and listed in Section 7.

11. Data retention

Retention periods per data category are in the Section 4 table. Deletion triggers: your deletion request, account closure, revoked consent (for data we process on the basis of consent), or the end of the stated period — whichever comes first, except where payment, tax, or dispute law requires us to keep specific records longer (see the payment-records row in Section 4). When you close your account, your authored content remains exportable for 30 days; at the end of that 30-day window we delete or de-identify your personal data, keeping only what payment, tax, or dispute law requires. Voice recordings are deleted after transcription and pronunciation analysis (Section 6). School-program student data is kept for the duration of the school engagement, then deleted or returned to the school (Sections 4 and 8).

12. Security

We run a written security program with a designated coordinator: encryption in transit and at rest, access controls and least-privilege access, periodic risk assessments and testing, and written security assurances from service providers. No system is perfectly secure; if a breach affects your personal data, we will notify you and regulators as applicable law requires, without undue delay.

13. International data transfers

Polymorph serves learners globally. Your data is processed on the infrastructure of our website hosting providers (currently Framer and Vercel), which may store and process it in the United States and other countries. For transfers out of the EEA, UK, or Switzerland we rely on appropriate safeguards such as the EU Standard Contractual Clauses (with the UK Addendum where applicable), with supplementary safeguards where needed. Copies of relevant safeguards are available via wing@ngchow.com.

14. Cookies and tracking

We use only strictly necessary cookies and local storage to run the site. We currently use no third-party analytics or advertising trackers and no non-essential cookies. If we ever introduce analytics, we will update this policy first and, in the EEA/UK, load any non-essential cookies only after you consent. Section 7 describes how we treat Global Privacy Control signals. We do not respond to legacy Do Not Track headers.

15. Changes to this policy

We date every version, and prior versions are available on request by emailing wing@ngchow.com. For material changes we notify you by email and in-product before they take effect. Material changes do not apply retroactively to data we already hold without your fresh opt-in consent — expressly including any new use of existing data to train or improve AI models — except where a change is required by law or legal process. If you decline consent to a discretionary new use, we will continue to handle your existing data under the prior terms, or delete it at your request.

16. Contact and jurisdiction-specific details

Privacy contact for all privacy matters — questions, rights requests, and appeals: wing@ngchow.| Where you live | What's different | |---|---| | California | Rights to know, delete, correct, and limit sensitive PI (Sections 3, 9). In the 12 months before this policy's date we collected only the identifier (name, email, phone, IP address) and internet-activity (usage logs) categories in Section 3; the remaining categories begin at launch of the relevant features, and we will update this disclosure then. We disclosed personal information only to the service providers/contractors in Section 7, for the purposes in Section 4. We have not sold or shared personal information — and we will never sell or share the personal information of consumers under 16 (Section 1). The right to limit sensitive PI does not currently apply, because we use sensitive information (account credentials, once accounts launch) only to provide and secure the service (Section 3). Appeal denied requests via wing@ngchow.com. | | Colorado, Connecticut, Virginia, Texas, and other US states with privacy laws | Rights to access, correct, delete, port, and opt out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do none of these — Section 4). Denied requests can be appealed; if your appeal fails, you may contact your state Attorney General. We honor universal opt-out signals such as GPC (see Section 7). | | EEA / UK / Switzerland | Legal bases per Section 4, including the teen-learner note below the table. Withdraw consent anytime, as easily as given. Object to legitimate-interest processing. Complain to your local supervisory authority (UK: the ICO). Transfers per Section 13. Minors: Section 8 covers ages of digital consent and the UK Age Appropriate Design Code. | | Everywhere else (including Hong Kong and other regions we serve) | The baseline rights in Section 9 apply to everyone, on the response timeline in Section 9. Contact wing@ngchow.com and we will honor local-law rights that go further. |

Subscriptions, any free trials, and cancellation are governed by our Terms of Service at /terms.